full-disclosure - Re: Phishing using IE7 local resource vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <003e01c7674d$c5bd9ff0$5138dfd0$@com>
Date: Fri, 16 Mar 2007 00:03:31 +0200
From: "avivra" <avivra@...il.com>
To: "'Matthew Murphy'" <mattmurphy@...rr.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Phishing using IE7 local resource
	vulnerability

Indeed. This should work, as "Restricted Sites Zone" is in "High" security
level by default.
To correct myself, I meant that this was the only way _I can think of_ to
mitigate this vulnerability using an out-of-the-box security feature. 

--Aviv.

-----Original Message-----
From: mattmurphy531@...il.com [mailto:mattmurphy531@...il.com] On Behalf Of
Matthew Murphy
Sent: Thursday, March 15, 2007 11:46 PM
To: avivra
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Phishing using IE7 local resource
vulnerability

On 3/15/07, avivra <avivra@...il.com> wrote:
> Hi Robert,
>
> Protected Mode and UAC are different security features.
> But even though, it is possible to access local resource ("res://") links
> with Protected Mode and UAC features enabled. You can test it yourself
here:
> http://www.raffon.net/research/ms/ie/navcancl/cnn.html or watch the demo
> video here: http://raffon.net/videos/ie7navcancl.wmv.
> The only way to mitigate this vulnerability by an out-of-the-box security
> feature is to set the security level of the "Internet Zone" to "High".
This
> will disable "javascript:" links, so the user will not be able to click
the
> "Refresh the page." link in the navcancl.htm local resource page.
> But, I doubt anyone will do that when they can simply just avoid clicking
> any link in the "Navigation Canceled" page.
>
> --Aviv.

On XP SP2 (and probably Vista), you can block the exploitation of this
by disabling script execution for the res:// scheme specifically.
Note that I didn't try blocking the specific resource involved in the
attack.

If you attempt to add "res://*" or "res://ieframe.dll/navcancl.htm" to
the Restricted Sites zone, this results in an entry for
"about:internet" being added.  After doing this, the "Refresh the
page" text is no longer a clickable link.  Removing the
"about:internet" entry reverses the change.  It seems that making this
change blocks scripts in ANY resource, even without the wildcard.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/